Who we are
RapidForensics provides financial and cryptocurrency forensics services — transaction analysis, fund tracing, the preparation of freeze requests, and evidence reports.
For the purposes of UK data protection law we are the data controller for the information described in this notice. That means we decide what is collected and what happens to it, and we are answerable for it.
The legal name of the business behind RapidForensics is Rapid Forensics, registered in England and Wales under company number [ company number ]. Our registration with the Information Commissioner's Office is [ ICO registration reference ].
RapidForensics is not a law firm. We are not regulated by the Solicitors Regulation Authority and nothing we send you is legal advice. Information you give us is not covered by legal professional privilege. If privilege matters in your situation — and in a dispute it often does — instruct a solicitor first and ask them to engage us on your behalf. We can work alongside your lawyer and hand our findings directly to them.
You can reach us about anything in this notice at admin@rapidforensics.org or on +44 20 3479 3412.
What this notice covers
This notice applies to the RapidForensics website and to the case intake form on it. It covers the point at which you first make contact and we assess whether we can help.
If we go on to work together, we will give you a separate engagement letter setting out how we handle case material specifically — bank statements, wallet addresses, exchange records and the rest. That material is usually far more sensitive than an enquiry, so it gets its own terms rather than being swept up in a website notice.
What we collect, and why
We collect two kinds of information: what you send through the form — typed or attached — and a small amount of technical detail that comes with any web request. Both are listed in full below — there is nothing else.
Information you give us
| What | Required | Why we hold it |
|---|---|---|
| Your name | Yes | To know who we are corresponding with and to address you properly. |
| Email address | Yes | To send you our initial assessment. This is our primary route back to you. |
| Phone number | No | An alternative way to reach you where a matter is time-critical. Leave it blank if you would rather we only wrote to you. |
| Your description of the situation | Yes | To work out whether the matter is one we can realistically help with, and what could be pursued. |
| Supporting documents you attach | No | Bank statements, payment confirmations, screenshots and similar records, so that we can see the transfers rather than rely on a summary. Up to ten files of 25 MB each. We store the file, its name, its size, its type and a checksum of the contents. Attaching nothing is a perfectly normal enquiry. |
| Your acknowledgement of this notice | Yes | We record the date, time and version of the notice you were shown when you submitted, so that both sides have a record of what you were told. |
Information collected automatically
| What | Why we hold it |
|---|---|
| IP address | Spam and abuse filtering, and a basic audit trail showing where a submission came from. An IP address can indicate your approximate location and your internet provider. |
| Browser and device string | Spam filtering, and diagnosing faults where a submission fails. |
| Referring page | To understand how people arrive at the site, in aggregate. |
| Date and time of submission | Ordering our intake queue and the audit trail. |
| A submission reference | A technical identifier from our forms provider, used to make sure a submission is never recorded twice. |
The form accepts supporting documents, but only the ones listed above and only because seeing the records saves you retelling them. We do not ask for, and you should never send us, any of the following — in the description box or in a file: card or account numbers you do not need us to see, passwords, wallet private keys or seed phrases, identity documents we have not asked for, or medical records. If a document you want us to have contains something in that list, redact it or wait until we have agreed a route for it.
We do not buy personal information from data brokers, we do not enrich or profile you against outside sources, and we do not make any automated decision about your case. A person reads every enquiry.
Please don't over-share
Send us the outline, and only the records that show it. A few sentences is genuinely enough for us to tell you whether we can help: roughly what happened, roughly when, roughly how much, and which banks or platforms were involved. Attach a statement or a payment confirmation if you have one to hand — not your whole file.
The description box is free text and the drop box takes whole files, so between them you could hand us a great deal more than we need. Please resist. In particular, do not send your own card details, passwords, recovery phrases or health information, or the full name and details of a person you believe defrauded you — and check a document for those before you attach it.
Allegations about a named individual are information about a criminal offence, which carries extra obligations under data protection law for us and creates real risk for you if it turns out to be mistaken. There is a proper time for that detail — under an engagement, once we have agreed how it will be handled. Not in a first message through a web form.
If you have already sent us more than you meant to, write to us and we will delete the surplus. See your rights below.
Our legal grounds
UK data protection law requires us to have a specific lawful basis for holding your information. Ours are:
- Steps towards a contract. You have asked us to assess your case. Reading your enquiry and replying to it are the steps that have to happen before we could be engaged, so we rely on Article 6(1)(b) of the UK GDPR for your name, email, phone number and description.
- Our legitimate interests. For the technical details — IP address, browser string, referrer — we rely on Article 6(1)(f). Our interest is in keeping the site free of spam and automated abuse and in being able to show where an enquiry came from. We have weighed that against your privacy and consider it proportionate, because the data is minimal, is never used to target you, and is deleted on the timetable set out below. You can object to this; see your rights.
We are not relying on consent for any of the above, which means you cannot get into the awkward position of having "consented" to something you did not really have a choice about. The acknowledgement tickbox on the form is exactly what it says — a record that you were shown this notice — and not a consent to some wider use. Equally, it means you cannot withdraw consent as a way of stopping us holding an enquiry; use your right to erasure or to object instead.
Where it is stored
Enquiries are stored on managed database infrastructure operated by our hosting provider in the eastern United States, and a copy of each submission is also retained in that provider's form-handling dashboard so that a technical failure can never lose an enquiry. Documents you attach are held in that same provider's object storage, with the database holding the record of which document belongs to which enquiry.
That means your information leaves the United Kingdom. Transfers of this kind are permitted where appropriate safeguards are in place; we rely on the International Data Transfer Addendum to the European Commission's standard contractual clauses, as incorporated into our provider's terms. You can ask us for details of that safeguard.
If you would prefer that your information never crossed the Atlantic, do not use the form — email or telephone us instead, using the details above.
How long we keep it
We do not keep enquiries indefinitely. Our schedule is:
- Enquiries that do not become cases — deleted [ 12 months ] after our last exchange with you. We keep them that long because people often come back to us months later having decided to proceed, and it saves you retelling the story.
- Enquiries where we decline the work — deleted [ 12 months ] after we tell you, so that we have a record of what we were asked and what we said.
- Enquiries that become engaged matters — folded into the case file and kept for [ 6 years ] after the matter closes, which reflects the period in which a professional claim could still be brought. Your engagement letter will confirm this.
- Submissions caught by the spam filter — never reach us and are discarded by our provider on their own schedule.
- Documents attached to an enquiry — deleted with the enquiry they belong to, on whichever of the timetables above applies. A document uploaded through the form where the enquiry was then never sent is deleted unsent.
You can ask us to delete an enquiry sooner than any of the above, and unless we have a specific legal reason to keep it, we will.
How we protect it
The whole site is served over an encrypted connection, and the form submits over that same encrypted connection. Stored enquiries are encrypted at rest and access to the database is restricted to credentials held by our platform rather than embedded anywhere in this website's code.
Access to enquiry content is limited to the people at RapidForensics who need it to assess and progress cases. What you type is passed to our database through a parameterised query and is length-limited on arrival, so a submission cannot be used to interfere with our systems. Documents are stored privately: there is no public address for them, they are never served back into a web page, and retrieving one requires a credential held by us and not by this website.
No system is perfect, and we would rather say so than imply otherwise. If a breach occurred that was likely to result in a risk to your rights, we would report it to the Information Commissioner's Office within 72 hours of becoming aware, and tell you directly where the risk was high.
Your rights
Over the information we hold about you, you have the right to:
- Be told what we hold and what we do with it — which is what this notice is for.
- Get a copy of it, free of charge.
- Have it corrected if it is wrong or incomplete.
- Have it deleted. For an enquiry that has not become a case, we will generally just do this.
- Restrict what we do with it — ask us to hold it but stop using it, for example while a correction is being sorted out.
- Object to our using it where we are relying on legitimate interests, as we do for the technical details listed above.
- Receive it in a portable form, so that you can take it elsewhere.
- Not be subject to automated decision-making. We do not do any, so this one is already satisfied.
Exercising any of these costs you nothing, and we will not treat your enquiry any less favourably because you did.
Making a request
Write to admin@rapidforensics.org and tell us what you want. You do not need to use any particular form of words, quote this notice, or explain why.
We will respond within one month. If a request is genuinely complex we may extend that by up to two further months, and if we do we will tell you within the first month and explain why.
We may need to satisfy ourselves that you are who you say you are before we hand over personal information — an obvious precaution, given what we do. We will ask for the minimum necessary to be confident, and we will not use anything you send for identity checking for any other purpose.
Complaints
If you are unhappy with how we have handled your information, please tell us first at admin@rapidforensics.org. We would much rather fix it ourselves.
You also have the right to complain directly to the UK's data protection regulator, and you do not have to come to us first:
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline 0303 123 1113 — ico.org.uk/make-a-complaint
If you are in the EEA, you may instead complain to the supervisory authority in your own country.
Changes to this notice
If we change how we handle personal information, we will update this notice, raise the version number, and change the date at the top of the page. Every submission records which version you were shown, so we can always establish what you were told at the time.
Where a change materially affects people whose enquiries we still hold, we will contact them directly rather than relying on them to re-read this page.
This is version 1.1, effective 23 September 2026. It was raised from version 1.0 when the intake form began accepting supporting documents.