Privacy policy

Who processes the data

The controller is Aureline Group (“we”). This policy covers the site, the incident form, the consultation form and the case cabinet.

We are a private forensic organisation. We are not a public authority and we do not promise recovery of funds.

What we receive

The set of data depends on which form you complete.

• Identity and contact: name, email, phone, date of birth, address, country of birth, residence and tax residency.
• Case material: incident type, description, extra facts (addresses, amounts, links), passport or ID files, and documents you later upload in the cabinet.
• Technical data: an IP hash, user-agent, interface language and referral source. We do not store the IP address in clear text.
• Case correspondence: emails, analyst requests and your replies in the cabinet.

Why, and on what basis

We use the data to receive the report, verify identity, assess the prospect of a matter, contact you and run the cabinet. Identity documents are requested only to verify the person who filed.

Bases: your consent when you submit the form; steps taken at your request before a contract; a legitimate interest in protecting correspondence and preventing abuse; and legal duties where applicable law requires them, including Russia’s 152-FZ and the GDPR for people in the EEA and the United Kingdom.

Who receives it

We do not sell personal data and we do not pass it on for third-party advertising.

Staff working the matter can access it. Technical providers — mail delivery and private storage — process it only on our instructions. A bank, venue, regulator or counsel receives material only when that is required for your matter and we have a basis to share it.

Where it is kept, and for how long

Records sit in a private database. Files sit in private storage and are opened through short-lived links.

We keep a report and its files while the matter is open and for as long as correspondence, a dispute or a legal duty requires. We then delete or de-identify them. The cabinet code is time-limited and is replaced if you request a new one.

Your rights

You may ask us to:

• tell you what we process and provide a copy;
• correct inaccurate details;
• withdraw consent and ask for deletion where we have no other lawful reason to keep the record;
• restrict or object to processing;
• complain to the supervisory authority where you live.

What not to send

Do not send seed phrases, passwords, banking-app codes or full card numbers. A statement, a descriptor, an address, a txid and an identity document are enough.