Information provided to ACRO by users through the use of this website will be treated in confidence and will not be disclosed to third parties unless we are required to do so by law.
We gather information about site usage to help the development and improvement of services to the public, and to protect the integrity of our systems from malicious users. At the moment this information consists of:
- Statistical information obtained using Google Analytics. No information collected can be used to identify individual users. For more details about how this affects your privacy please visit the Google Analytics Privacy Centre. If you don’t want to send information to Google Analytics, an Opt-out Browser Add-on is also available or you can configure your browser to let you to choose which, if any, cookies are allowed to be created.
- Information obtained by our content management system to examine what people are searching for, what they find and occasions where no results are returned. Information collected can’t be used to identify individual users.
- Information provided by users through online forms; it's held in our UK-based secure data centres and is retained in line with the Data Protection Act 2018, the General Data Protection Regulation (EU) 2016/679, and our retention policies.
Host Force Privacy Notice
ACRO is hosted by Hampshire Constabulary, meaning that ACRO is covered by their privacy notice as the host force.
The use and disclosure of personal data is governed in the United Kingdom by the Data Protection Act 2018 (‘the Act’) under which Hampshire Constabulary is registered as a ‘data controller’.
As such, Hampshire Constabulary is obliged to ensure that it handles all personal data in accordance with the Act.
Hampshire Constabulary’s privacy notice provides information about how they obtain, hold, use and disclose information about people (their personal data), the steps they take to ensure that it is protected, and the rights individuals have in regard to their personal data handled by Hampshire Constabulary.
ACRO Processing Activity Privacy Notice
Supporting United Kingdom (UK) and International Law Enforcement by processing criminal records for the purposes of public protection, safeguarding and worldwide community safety.
The use and disclosure of your personal data is governed in the United Kingdom by the UK General Data Protection Regulation, and the Data Protection Act 2018 (DPA).
ACRO is a Data Processor, acting on behalf of the 43 Police Forces (Controllers) that are party to the ACRO Collaboration Agreement, created under s22a of the Police Act 1996. This established ACRO as a Competent Authority, as defined under Schedule 7 (17) DPA.
ACRO is hosted by Hampshire Constabulary. Our policing powers derive from having a Chief Superintendent from the Constabulary in position as the Head of ACRO.
What type of data we hold on you:
ACRO will receive criminal conviction data and intelligence from international police forces and other agencies, and conduct research on UK police databases. We also process special category personal data where it is relevant and there is a lawful basis to do so, such as;
- racial or ethnic origin
- political opinions, religious or philosophical beliefs
- trade union membership
- genetic data, biometric data
- data concerning health
- data concerning a natural person's sex life or sexual orientation
Why do we process your data:
ACRO manages the United Kingdom's Criminal Record Information System (UK-CRIS), which exchanges conviction information with European Union (EU) Member States. This responsibility is designated by the Home Secretary to the Chief Constable of our host force, who delegates it to the Chief Executive Officer (CEO) of ACRO.
Outside the EU, we exchange information records with all non-EU Interpol countries via Interpol Channels.
ACRO delivers services to members of the public including Police Certificates, International Child Protection Certificates (ICPCs) and the co-ordination of Subject Access and Record Deletion Requests for Police National Computer (PNC) data.
We also provide PNC services to Non-Police Agencies who have a lawful basis to process data for Law Enforcement or General Purposes.
We are designated to process Fixed Penalty Notices for violations of Covid-19 Regulations on behalf of Police Forces and Local Authorities.
How we store your information:
Criminal convictions that meet the criteria for creation of a record on the Police National Computer (PNC) are retained until the data subject is 100 years of age. All other records are retained in line with the National Police Chiefs’ Council (NPCC) retention and disposal schedule.
Your Data Protection Rights:
Under s.45 of the Data Protection Act 2018 (DPA) and Article 15 of UK GDPR, you have the right of access. ACRO process Subject Access Requests on behalf of the police service in respect of PNC data, in addition to data held on ACRO local systems.
If you would like more information about use of personal data held by specific police forces, the website for each force can be found at www.police.uk and each will have links to their Subject Access and Data Protection pages.
Under s.47 DPA and Article 17 of UK GDPR you have the right to request erasure. ACRO facilitates the Record Deletion process for PNC, Ident. 1 and NDNAD (national UK systems) on behalf of the police service, in addition to data held on ACRO local systems.
For all subject rights for data held on ACRO systems, including the Rights of Access, Erasure, Rectification (s.46, Article 16), Restriction (s.47, Article 18), Automated Decision Making (s.49-50, Articles 21-22), Data Portability (Article 20), please email ACRO Information Management.
Freedom of Information (FOI) Requests for information held by ACRO under the Freedom of Information Act 2000 (FOIA) are managed by the NPCC via the National Police Freedom of Information and Data Protection Unit.
How to provide feedback or raise a concern:
ACRO welcomes feedback and we will endeavour to resolve any concerns at the earliest opportunity. You can make contact with us using any of the details below.
ACRO Contact Details:
Postal address: ACRO Criminal Records Office, PO Box 481, Fareham, PO14 9FS
Customer Services telephone number: +44 (0) 02380 479 920
Customer Services email address: firstname.lastname@example.org
ACRO Data Protection Officer:
You can email our data protection officer or write to:
ACRO Data Protection Officer, PO BOX 481, Fareham, PO14 9FS
Data Protection Officer: DataProtectionOfficer@acro.police.uk
ACRO Information Management: email@example.com
ICO Contact details:
Should you wish to raise a concern about how your personal data is managed you also have the right to contact the Information Commissioner’s Office. www.ico.org.uk.