WHO MAY INSTRUCT AXETEN
Axeten accepts instructions from law firms, Private Investigators (PIs), corporate entities and NGOs that are registered with the Information Commissioner's Office (ICO), or the equivalent data protection authority in their jurisdiction.
Axeten does not accept instructions from private individuals. A solicitor or a registered Private Investigator (PI) must be engaged by the private individual. The Law Firm or PI may then instruct Axeten on their behalf. Their fee is in addition to the Axeten fee.
On request, we can put you in touch with solicitors and PIs who instruct Axeten. Some of these PIs have OSINT capabilities of their own and may carry out the work themselves.
DATA PROTECTION
A Data Processing Agreement (DPA) must be agreed between the instructing party and Axeten before an instruction is accepted. The instructing party is expected to provide its own DPA. Where you do not have one, Axeten, for a minimal fee, can compose a DPA for your organisation, for your review and approval, which you can use with Axeten and with any other processor.
In compliance with the GDPR (UK and EU), Axeten acts as a Data Controller/Processor: Data Processor for your instruction, and Data Controller for the means of the investigation, such as the sources searched and the methods used.
Record the lawful basis and the purpose of the investigation. Before processing starts, Axeten completes its own Legitimate Interests Assessment and, where required, a Data Protection Impact Assessment. A DPIA is always required where any person whose data will be processed was a minor during any part of the period investigated.
THE INSTRUCTION
New clients send their instruction in the secure form on the Axeten website (contact form). Existing clients may send instructions by email. When sending an instruction by email, the instruction must always be in an attached document. The body of the email should never include personal data.
There is no fixed format. What you can include depends on what you hold. Transfer everything you hold that relates to the subject, even if it has not been verified. The GDPR does not prevent its transfer to Axeten under the DPA.
Include, where you have it:
- your case reference
- the purpose and scope of the investigation
- the subject, as far as you know them: names, dates of birth, addresses, email addresses, phone numbers, online account names and links
- full details of any event or incident central to the investigation: dates, times and locations
- any other people involved, and whether each is a subject or an associate
- priority: standard or urgent
Include personal data about other people only where it is relevant. Anyone named who is not a subject is treated as an associate, and their data should be limited to what the investigation needs.
COMPLEX INSTRUCTIONS
Some instructions need more than the basic content above.
Subject Not Identified
The subject may not be known to you. You may hold only an online account that does not identify its owner. Provide the URL of the account, any previous usernames, screenshots and any technical information you hold.
An account alone is unlikely to identify the person behind it. However, the account, any previous usernames and the technical information you hold should provide leads for a wider OSINT search that may identify them.
Impersonation can be reported directly to the platform, free of charge, and the account may be removed. If you take this route, it will limit what can be located with an OSINT investigation.
Organisations
The subject may be a registered company or an unregistered organisation, such as an Organised Crime Group (OCG), where several people are expected to be processed. Describe what you know about the organisation and any intel you might have about its members. Where possible, state which members are subjects.
Multiple Subjects
Where an instruction includes more than one subject, list each subject separately with what intel you hold on each.
IDENTIFICATION OF THE SUBJECT
Axeten shall intend to locate and corroborate a positive identification of the subject.
Where you provide online accounts believed to belong to the subject, Axeten shall process them on the basis that the account might be assigned to the subject. Be prepared for Axeten to determine that the account is not assigned to a person within the scope of the investigation.
EXTENDING THE SCOPE
Associates of the subject are not processed by default.
During an investigation, Axeten might revert to you to suggest and request an extension of the scope, for example to process the online accounts of associates of the subject. The request will state the number of associated online accounts identified and include a quote for the extended scope.
An extended scope requires an extended Legitimate Interests Assessment and, where appropriate, a Data Protection Impact Assessment, completed before the extended scope is processed. The extended scope is processed only with your approval.
SAFEGUARDING
If an account has contacted any young people, or there is any indication of sexual content or grooming, report it to the police rather than pursuing a private investigation. A solicitor or PI can also report concerns about a child's online safety to CEOP.
ACCEPTANCE AND DELIVERY
Axeten responds to each instruction with a notice of acceptance, including the anticipated delivery date and the fee. Fees are set out in the price guidelines.
Standard delivery is usually 15 to 20 working days. Urgent delivery, within 10 working days, incurs a premium of 50%.
CASE SPECIFIC INFORMATION
- Personal injury: date and location of the incident, the reported injury and its effect on lifestyle.
- Staged accident: date and location of the accident.
- Employee absence: date the absence began and the reported reason.
- KYC/CDD, brand protection, corporate or private client care: enough detail to start and direct the investigation.