How we handle your data
We collect what a regulator needs and nothing else. Identity and qualification documents are accepted only through a secure upload link, never by email or messaging app, are encrypted at rest, are reachable only by staff working on your case, and are deleted at the end of a stated retention period.
Why do we not accept documents by email or WhatsApp?
Because a passport scan in an email inbox is a passport scan you have lost control of. Email is stored on servers neither of us controls, forwarded without a record, and retained indefinitely by default. A messaging app backs up to a personal cloud account. Neither gives you a record of what you sent or a way to have it deleted.
What do we collect, and why?
When you enquire
Your name, email address, phone number, profession, target country, current location, and whatever you write in your message. We need these to answer you. We also store a one-way hash of your IP address, which is used only to rate limit the form against automated abuse and cannot be reversed to recover the address.
When you become a client
The documents the relevant authority requires. Typically that means a passport, degree and post-graduate certificates, transcripts, professional registration certificates, experience and good standing letters, and photographs to the authority's specification. For some professions and specialties it also includes a logbook.
These are sensitive. We ask only for what the authority you are applying to actually requires, and we will tell you which requirement each document satisfies. If you think we have asked for something unnecessary, challenge it.
When you browse this site
[REPLACE_ANALYTICS_DISCLOSURE] Analytics are not yet configured on this site. When they are, this section will state which product is in use, what it records, whether it uses cookies, and how to opt out. We will not deploy anything that builds an advertising profile of you.
How are your documents protected?
They never pass through our web server
Uploads go directly to storage using a short-lived signed link. The file does not transit the application, so a compromise of this website is not a compromise of your documents.
Encrypted at rest, in a private store
Storage is private with no public addresses of any kind. There is no link to your passport that anyone could stumble upon, share or index.
Reachable only by staff working on your case
Access requires an authenticated staff account and is limited to the people handling your file. Access is logged.
Scanned on upload
Every file is virus scanned before it is stored. We accept PDF, JPG and PNG only, up to 10MB per file. Other formats are refused rather than quarantined.
Who else sees your information?
Only the parties your application requires, and only what it requires. We do not sell data, we do not share it for advertising, and we do not pass your details to recruiters or employers.
- The licensing authority you are applying to. This is the point of the engagement.
- The primary source verification provider used by that authority, which contacts your university, regulator and former employers to confirm your documents.
- Examination providers, where booking an examination is part of what you have instructed us to do.
- Attestation agents and government service centres, where a document must be legalised in the country that issued it.
- Our own service providers, meaning hosting, storage and email, under contract and only to the extent needed to run the service.
Your documents travel between the countries this process requires, which for most clients means between India, the Gulf state you are applying to, and the country that issued your qualification. That is inherent in international credentialing rather than a choice we make.
How long do you keep it, and how is it deleted?
Documents are held for [REPLACE_DOCUMENT_RETENTION_PERIOD] after your engagement ends, then deleted. We keep them that long for one reason: licensing applications are frequently queried, resubmitted or renewed, and reassembling a document set from scratch is slow and expensive for you.
Enquiry records that do not become engagements are deleted after [REPLACE_ENQUIRY_RETENTION_PERIOD]. Records we are required to keep for tax or accounting purposes, such as invoices, are kept for the period the relevant law requires and no longer.
Asking for earlier deletion
You can ask us to delete your documents at any time, including during an engagement, although doing so mid-application will usually end the application. Write to [REPLACE_DATA_PROTECTION_EMAIL] from the email address on your file. We will confirm what we hold, delete it, and write back to confirm the deletion within [REPLACE_DELETION_SLA]. Deletion is permanent and covers backups within the backup cycle.
What rights do you have over your data?
Whatever your location, we will honour the following. Write to [REPLACE_DATA_PROTECTION_EMAIL] and we will respond within [REPLACE_DSR_SLA].
- Ask what we hold about you, and get a copy of it
- Have inaccurate details corrected
- Have your data deleted, subject to records we must keep by law
- Withdraw consent to being contacted, without affecting work already done
- Object to a particular use of your data, and have us explain or stop it
- Receive your data in a portable format
- Complain to a data protection authority in your jurisdiction
What happens if something goes wrong?
If a security incident affects your documents or personal data, we will tell you. Not a vague notice months later: what happened, what of yours was involved, what we have done, and what you should do. We will notify the relevant supervisory authority where the law requires it, within the period it requires.
If you think your data has been mishandled, tell us first at [REPLACE_DATA_PROTECTION_EMAIL]. You do not have to, and you can go straight to a regulator, but we would rather have the chance to fix it.
Who do you contact about this notice?
Data protection enquiries: [REPLACE_DATA_PROTECTION_EMAIL]. General enquiries: [REPLACE_EMAIL]. Company registration details for both Gulf Credentials entities are on our licence and registration.