Legal
Privacy notice
Version [1.0], effective [date].
1. Who we are
Policy365 Sanctions Screening is provided by [Company name], company number [Company number], registered office [Registered address] ("we", "us"). We are registered with the Information Commissioner's Office under number [ICO registration number]. For anything about this notice or your personal data, contact [Contact email] [or our data protection lead, [name]].
This notice explains what personal data the service holds, why, and for how long. It covers our business customers' contacts, the people whose names are screened, and visitors to this website.
2. What we hold
| Data | Where it comes from |
|---|---|
| Account details: the business's name, the contact's name, email address and phone number where given, and sign-in records. | You, when you sign up or update the account. |
| Payment details. Card details are held by Stripe, not by us. We hold Stripe's customer and subscription references and the billing status. | You, through Stripe's payment form. |
| Names screened: names of people and companies, with the month and year of birth where given, the role (such as "director"), and the customer's own reference. | Our customers, who send them to the API. |
| Company officers and persons with significant control: their names, roles, month and year of birth, nationality, occupation, appointment dates and any entries on the disqualified directors register. | Companies House's public register, which we query when a customer asks us to look up or screen a company. |
| Screening records: each request and its answer (the names above, the results and any listed entries they resembled), when it was made, by which customer, and which version of each list was used. | The service, as it screens. |
| Usage ledger: one row for each call, holding the customer, the key used, the endpoint, the customer's reference, the outcome, timings and the screening's id. It holds no names or dates of birth. | The service, as calls are made. |
| The homepage's try box keeps nothing typed into it. To limit it to ten lookups a day, the service remembers how many lookups each IP address has made in the last 24 hours, in memory only; that count is gone after 24 hours, or sooner if the service restarts. | Your browser's connection. |
| Website and security logs: IP addresses, times and the pages or endpoints requested. The service does not log the names or dates of birth in requests. [Confirm the hosting provider's log settings, including that query strings are not recorded.] | Your browser or your systems' connection. |
We use only what is needed to keep this site working (such as a sign-in cookie). [Confirm no analytics or advertising cookies are used.]
3. Our role
- For names our customers send us, we act as a processor: we screen them and keep the record on the customer's instructions, and the customer is the controller. If your name was screened by an insurer, broker or other business, they are the first place to ask about it.
- For account details, and for Companies House officer and controller data we fetch to screen a company, we act as a controller. [Confirm with adviser: whether Companies House data fetched at a customer's request is processed as controller or as processor, and whether the screening records are held jointly.]
4. Why we use it, and the lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service to customers, and running their accounts | Contract (with the customer); legitimate interests, for the contact people at a business customer |
| Screening names sent by customers (as processor) | The customer's basis; for them, typically legal obligation or legitimate interests in meeting sanctions law [confirm with adviser] |
| Fetching and screening Companies House officers and controllers (as controller) | Legitimate interests: helping customers meet their sanctions obligations, using a public register [confirm with adviser] |
| Keeping screening records as evidence of what was screened, against which list, and when | Legitimate interests (ours and our customers') in being able to show what was checked [confirm with adviser] |
| Billing and keeping accounting records | Contract; legal obligation (tax and company law) |
| Keeping the service secure and limiting misuse (rate limits, the try box's daily limit, logs) | Legitimate interests |
A screening result can show that a person resembles someone on a sanctions list. Where that amounts to data about criminal offences or allegations, it is processed under [the condition in the Data Protection Act 2018, Schedule 1: confirm with adviser]. The service makes no decisions about anyone: a possible match is passed to the customer for a person to look at.
5. How long we keep it
| Data | Kept for |
|---|---|
| Screening records and results files | Six years from the screening, then deleted. For those six years they are held under a write-once lock: no one can change or delete them, including us. |
| Usage ledger and billing records | [6 years — confirm] from the end of the financial year they relate to, for tax and accounting. |
| Account details | While the account is open, then [N years — confirm] after it closes. |
| Companies House answers held to save repeat lookups | Minutes, in memory (they are also kept inside any screening record they were used for). |
| Try box counts per IP address | 24 hours, in memory. |
| Website and security logs | [N days — confirm]. |
6. Who we share it with
We do not sell personal data. We use these sub-processors and sources:
| Who | What for | Where |
|---|---|---|
| Stripe | Taking payment, subscriptions and invoices | [UK/EU and USA — confirm] |
| Microsoft (Azure) | Hosting the service and its database | [UK South — confirm region] |
| Microsoft (Microsoft 365) | Sending email: sign-in links, account and billing notices | [UK/EU — confirm] |
| Companies House | A source, not a sub-processor: we send it a company name or number to look up. We do not send it the names of people you screen. | UK |
The sanctions lists are fetched from their publishers (the FCDO, the European Commission, the United Nations and Global Affairs Canada); nothing about anyone is sent to them. We may also disclose data where the law requires it, or to professional advisers under a duty of confidence.
7. International transfers
We aim to keep data in the UK [confirm]. Where a sub-processor handles it outside the UK (for example Stripe in the USA), the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or the UK International Data Transfer Addendum to the EU standard contractual clauses. [Confirm for each sub-processor.] You can ask us for details.
8. Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- have inaccurate data corrected;
- have data deleted, or its use restricted, in some circumstances;
- object to our use of it where we rely on legitimate interests;
- have data you gave us transferred to you or someone else, in some circumstances.
Some rights are limited where we must keep records to meet a legal obligation, or where data is held to prevent or detect crime. Where we hold your data as a processor for one of our customers, we will pass your request to that customer and help them answer it.
To use any of these rights, contact [Contact email]. We will answer within one month.
9. Security
Data is encrypted in transit and at rest. API keys are stored only as a hash and can't be read back. The service reaches its database only through fixed procedures, and its records can't be altered or deleted by the service itself. Each screening's answer and each results file is kept in storage locked against change or deletion for six years. [Confirm hosting and backup arrangements.]
10. Complaints
Please contact us first at [Contact email], and we will try to put things right. You may also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
11. Changes
We will update this notice when what we do changes, and show the date of the version in force at the top.