How we handle your data.

cftrace is a private investigative and repatriation bureau. For data-protection purposes we act as a data controller in respect of intake and matter data, and as a joint controller with counsel-of-record where they take primary carriage of a proceeding.

We process intake data on the basis of your request to assess a potential engagement (pre-contractual measures). Once retained, we process matter data on the basis of contract performance, legitimate interest in pursuing the matter, and legal obligation (AML/KYC).

All matter files are encrypted at rest in EU/UK data residency. Access is role-based and logged. Backups are encrypted and retained per the schedule below.

Intake-only enquiries are retained for 12 months and then deleted. Matter files are retained for 7 years from closure to satisfy AML record-keeping obligations and to support any subsequent enforcement step. You may request earlier deletion subject to our legal-hold obligations.

We share data with counsel-of-record for the conduct of your matter, with regulated escrow agents for repatriation, and with law enforcement where required by law or instructed by you. We do not sell data and we do not use it for marketing.

Subject to local law you may request access, rectification, deletion, portability, and restriction of processing. To exercise any right, write to the address provided in your engagement letter or via the contact form.

You may complain to the data-protection authority of your country of residence. We ask that you raise the issue with us first so we can correct any error directly.