1Who we are
DDcheck provides know-your-business (KYB) and anti-money-laundering (AML) screening software. DDcheck is operated by [OPERATOR LEGAL ENTITY — registered name, company number and registered office to be inserted] ("we", "us"). Because the Service is aimed at obligated entities across the EU/EEA and processes data about EU-based companies and individuals, the EU GDPR (Regulation (EU) 2016/679) applies as the primary framework for those data subjects; the UK GDPR and the Data Protection Act 2018 apply to processing in the UK context. For the processing described in this policy we are the data controller, except where we act as a processor on a customer's behalf (see section 3). Where we are established outside the EU, we will appoint and name an Art. 27 EU representative [to be confirmed] as the contact point for EU data subjects and supervisory authorities. The controller's legal identity and lead supervisory authority are being finalised and will be stated here before general availability.
2Whose data we process
This policy covers two distinct groups of people:
- Users — the individuals who register for and use the Service (our customers and their authorised users).
- Search Subjects — the companies, and the individuals behind them, whom you screen or look up through the Service, such as company directors, beneficial owners, shareholders and managers, politically exposed persons (PEPs), and people named in sanctions, watchlist or adverse-media sources (referred to below as "screened persons"). These people are usually not our users, and the data about them generally comes from public and third-party sources rather than from the person directly.
3Controller and processor roles
Our role depends on the activity:
- We act as an independent controller for the collection, aggregation, curation, scoring and presentation of the screening information that makes up the Service. Because we decide which sources to draw on and how that information is organised, we are the controller for that processing — not merely a processor.
- When you submit a search (for example, a name or registration number) and we process it to return a result for you, we act as a processor on your documented instructions — and you act as an independent controller for your own use of the result.
We do not make decisions or recommendations about any screened person; any decision based on a result is yours.
4What data we process
About users
- account and identity data (name, work email, organisation, login credentials in hashed form);
- billing and subscription data (plan, quota usage, invoices; card details are handled by our payment provider, not stored by us);
- technical and usage data needed to operate and secure the Service (IP address, request logs, API-key usage, error and audit logs).
About screened persons
- identity and role data (name, role/title, date of birth where published, nationality, country, company associations and ownership);
- risk-relevant data such as sanctions designations, PEP status and connections, watchlist entries, insolvency records and adverse-media references.
5Where the data comes from
User data comes from you. Data about screened persons is aggregated from public and private third-party sources, including: official company and beneficial-ownership registries; sanctions and watchlists (such as OFAC, EU, UN and UK OFSI consolidated lists); PEP and adverse-media sources; aggregators such as OpenSanctions and ICIJ Offshore Leaks; insolvency and tax registers; and commercial data providers. We do not control these sources and do not independently verify their content.
6Why we process data, and our lawful basis
- To provide the Service to users — lawful basis: performance of a contract (UK GDPR Art. 6(1)(b)).
- To run screening and present information about screened persons — lawful basis: our legitimate interests and those of our customers (Art. 6(1)(f)) in preventing money laundering, terrorist financing, sanctions evasion and fraud, and in enabling regulated businesses to meet their legal obligations. The data concerns adults acting in a business or public capacity, the processing is limited and proportionate to that purpose, and it falls within their reasonable expectations. We balance this interest against the rights and freedoms of the individuals concerned, and we do not rely on consent for this processing. Where the processing supports the prevention of money laundering and terrorist financing, we additionally rely on the performance of a task in the public interest (Art. 6(1)(e)) and, for any special-category data, the substantial-public-interest condition (Art. 9(2)(g)).
- To secure, maintain, account for and bill the Service, and to comply with law — lawful basis: legitimate interests and, where applicable, legal obligation (Art. 6(1)(c)).
Our customers are typically regulated firms that rely on their own legal obligation and/or legitimate interests for their use of the results.
7Sanctions, PEP and other sensitive data
Some screening information — for example sanctions designations, PEP status or adverse-media references — may amount to criminal-offence data (UK GDPR Art. 10 / DPA 2018) or special-category data (Art. 9). Where it does, we process it under the substantial-public-interest and crime-prevention conditions in Schedule 1 to the Data Protection Act 2018 (including preventing or detecting unlawful acts and the prevention of money laundering or terrorist financing), together with the safeguards and policy documentation those conditions require.
8Searches, results and what we store
What we keep, and why:
- Short-term result cache. To make repeat checks fast and consistent, a screening result (including any screened-person data it contains) is cached for a short period — typically up to a few hours, and up to about 72 hours for some external sources — then expires.
- Ongoing monitoring. When you run an onboarding check or add an entry to monitoring, we store the company and the names of the screened persons so we can re-check them and alert you to changes. These entries are kept until you remove them; removing an entry stops further monitoring.
- Case files and dossiers. When a check is linked to a case, we store a snapshot of the result (which can include directors/beneficial-owners' names, dates of birth where published, nationality and sanctions/PEP/adverse-media findings) so the case has an audit trail. The Service is not your system of record. Result snapshots and generated PDF dossiers are retained for a short period only — at most 48 hours — and then deleted; a small case record (identifier, score, band, decision status) may remain. You must download and archive the PDF dossier within that window and keep it under your own AML record-keeping policy (typically five years). We cannot reproduce a screening result after it has expired.
- Operational and security logs (authentication events, request and error logs, API-key usage, abuse-prevention data), kept for short periods to run and protect the Service.
- Usage counts needed to apply quotas and billing.
- Any records we are required by law to keep (for example, AML record-keeping rules).
You can ask us to delete a case, monitoring entry or other stored data at any time (see section 13); some records may be retained where the law requires it.
9Notifying screened individuals
Because data about screened persons is collected from public and third-party sources — often without reliable contact details and at scale — providing individual notice to each person would involve disproportionate effort, and notice may also be restricted where it would prejudice the prevention of crime. We therefore rely on the exemptions in UK GDPR Art. 14(5) and the relevant DPA 2018 crime-prevention provisions, and we generally do not notify each screened person directly. Where you use results to make decisions about an individual, you are responsible for any notice or transparency obligation that your own law places on you.
10Who we share data with
We do not sell personal data. We share it only with:
- screening and data providers that we query to return a result — for example sanctions/PEP screening APIs (such as OpenSanctions and Dilisense) and adverse-media / web- search providers (such as news and search APIs). To run a check we may send them the name (and, where relevant, date of birth or nationality) of the person or company being screened;
- infrastructure providers / sub-processors that help us host and run the Service, and our payment processor, under contracts that require appropriate safeguards;
- authorities, regulators or courts where we are required to do so by law, or to establish, exercise or defend legal claims; and
- a successor in the event of a merger, acquisition or reorganisation, subject to this policy.
The current list of sub-processors is available on request.
11International transfers
We store our own data within the UK and the EEA. However, some of the screening, adverse-media and search providers we query (section 10) operate outside the UK/EEA — so a query we send to them (for example, a name being screened) may be processed in another country, including the United States. Where data is transferred outside the UK or EEA, we put appropriate safeguards in place — such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and EU Standard Contractual Clauses where relevant — together with a transfer risk assessment.
12How long we keep data
We keep personal data only for as long as reasonably necessary for the purposes set out above, taking into account its sensitivity, the risk of harm, and applicable legal, regulatory, tax and accounting requirements. Indicative periods (see section 8):
- Cached results — short-term only (typically a few hours, up to ~72 hours), then they expire;
- Monitoring entries — until you remove them;
- Case snapshots and PDF dossiers — retained for a short period only (at most 48 hours) and then deleted; the Service is not your system of record, so you must download and archive the dossier within that window and keep it under your own AML record-keeping policy;
- Operational and security logs — short periods needed to run and protect the Service;
- Account data — for the life of your account and a reasonable period afterwards;
- Records required by AML law — for the period that law specifies (typically five years).
13Your rights
Subject to applicable law, you have the right to: access your personal data; have inaccurate data corrected; request erasure; restrict or object to processing; data portability; and to withdraw consent where we rely on it. To exercise a right, contact us at privacy@ddcheck.uk; we do not charge for genuine requests.
These rights have limits. Where we process data for AML, crime-prevention or other legitimate-interest or legal-obligation purposes, we may be unable to erase or stop processing it, and we may decline manifestly unfounded or excessive requests. If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions: any risk score, flag or rating we provide is decision-support only, and the decision is taken by a person in the customer's organisation.
14Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, hashed credentials and least-privilege access. No system is perfectly secure, and we cannot guarantee absolute security.
15Children
The Service is intended for business use by adults and is not directed at children. We do not knowingly collect data from children as users.
16Changes to this policy
We may update this policy from time to time. We will post the updated version here and change the "Last updated" date; material changes will be notified by reasonable means.
17Contact
For privacy questions or to exercise your rights, contact privacy@ddcheck.uk.