Data processing agreement

1. 1.1

   This agreement sets out the data protection obligations of both parties for the processing described in the annex.

2. 1.2

   The scope, purpose, types of personal data and categories of data subjects are set out in Annex 1. For account and billing data we are an independent controller, as described in our privacy policy, and this agreement doesn't apply to it.

1. 2.1

   Account data and the subject map are stored in Cloudflare D1, restricted to the European Union. Screening runs at our screening engine, VerifyNow, in Cape Town, South Africa. Requests pass through Cloudflare's global network on their way.

2. 2.2

   We won't move processing to another country, or add a subprocessor in another country, except under section 11 and with a transfer mechanism under section 13.

1. 3.1

   This agreement runs for as long as we process personal data for you under the terms of service.

2. 3.2

   You may end the terms of service without notice if we seriously breach this agreement or data protection law and don't fix the breach within a reasonable time after you tell us.

1. 4.1

   We process personal data only on your documented instructions, unless the law requires otherwise; in that case we tell you before processing, unless the law forbids it.

2. 4.2

   Your instructions are the terms of service, this agreement, your API calls and your account settings. Further instructions must be in writing; email is enough. Instructions that change the scope in Annex 1 need our agreement.

3. 4.3

   If we think an instruction breaks data protection law, we will tell you, and may suspend it until you confirm or change it.

1. 5.1

   We help you answer requests from data subjects exercising their rights, taking into account the nature of the processing and the information we hold. Because we keep no readable copy of names or identifiers, we can usually help only by locating a subject through the reference you give us.

2. 5.2

   We help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority, taking into account the information available to us.

3. 5.3

   If a data subject or an authority contacts us directly about your data, we pass the request on to you without undue delay and don't answer it ourselves unless you tell us to or the law requires it.

1. 6.1

   We make available the information you reasonably need to show compliance with Article 28, including this agreement's annexes.

2. 6.2

   You may audit our compliance, yourself or through an independent auditor bound by confidentiality, once a year on at least 30 days' written notice, at your own cost, during business hours and limited to what is needed. You may audit more often after a personal data breach affecting your data, or if a supervisory authority requires it.

3. 6.3

   Before an on-site audit, we may first answer a written security questionnaire and provide our subprocessors' current certifications, such as Cloudflare's ISO/IEC 27001 and SOC 2 reports and Stripe's PCI DSS attestation. You audit on-site only if these don't reasonably answer your questions.

1. 7.1

   Our information officer under POPIA is Ruwaida Foster, reachable at privacy@onsanctions.com. We have not appointed a data protection officer under Article 37 of the GDPR, because we are not required to.

1. 8.1

   We keep your personal data confidential, during and after this agreement.

2. 8.2

   Everyone who can access it is bound by confidentiality in writing or by law, is trained in data protection, and has access only to what their role needs.

3. 8.3

   We disclose your personal data to third parties only with your consent, as section 5.3 provides, or where the law requires it.

1. 9.1

   We keep in place the measures in our technical and organizational measures (Annex 4), which take into account the state of the art, the cost and the risks of the processing.

2. 9.2

   We may update the measures as technology develops, as long as the overall level of protection doesn't fall. We publish the current version on that page.

1. 10.1

   We tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach or a reasonably suspected breach affecting your data, with the information you need to meet your own notification duties. We send further information as we learn it.

2. 10.2

   We investigate the breach, take reasonable steps to contain it and limit its effects, and help you remedy it.

3. 10.3

   We tell you straight away if your data is at risk from a seizure, insolvency proceedings or other action by a third party, and tell that third party that you are the controller.

4. 10.4

   This section also applies to breaches at our subprocessors.

1. 11.1

   You authorize the subprocessors on the subprocessors page (Annex 3). We may engage other subprocessors as this section provides.

2. 11.2

   We bind each subprocessor by written contract to data protection obligations at least as protective as this agreement, and remain responsible to you for its performance.

3. 11.3

   We will publish a change to the list and email account owners at least 30 days before a new or replacement subprocessor starts processing your data. You can object on reasonable data protection grounds within that period. If we can't resolve the objection in good faith, you can end the affected service and get a refund of prepaid fees for the unused period.

1. 12.1

   Withdrawing a subject through the API removes it from your active subjects. When the terms of service end, we delete your screening data within 30 days, unless the law requires us to keep it.

2. 12.2

   Before deletion, you can export your call log and subject references from the account page; we hold no readable names or identifiers to return.

3. 12.3

   Enrollment audit metadata is kept for seven years after withdrawal so that you can meet record-keeping duties under anti-money laundering law; it is then deleted. On request, we confirm deletion in writing.

1. 13.1

   Personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to us in South Africa, which has no adequacy decision. For those transfers, the parties enter into the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor), which are incorporated into this agreement by reference.

2. 13.2

   For the Clauses: clause 7 (docking) applies; under clause 9, option 2 (general written authorization) applies with the notice period in section 11.3; the optional wording in clause 11 doesn't apply; under clauses 17 and 18, the law and courts of Ireland apply; and Annexes I and II are completed by Annex 1 and Annex 4 of this agreement.

3. 13.3

   For UK transfers, the UK International Data Transfer Addendum applies, with Table 1–3 taken from this agreement and either party able to end it as section 19 of the Addendum allows. For Swiss transfers, the Clauses apply with the amendments the Swiss FDPIC requires.

4. 13.4

   Onward transfers to subprocessors follow clause 8.8 of the Clauses. Transfers of personal information out of South Africa meet section 72 of POPIA.

5. 13.5

   If the Clauses conflict with this agreement or the terms of service, the Clauses prevail.

1. 14.1

   You confirm that you have a lawful basis to screen the people and companies you send, that you have given any notice the law requires, and that your instructions comply with the law.

2. 14.2

   You don't send special categories of personal data or criminal offense data.

1. 15.1

   Liability under this agreement is subject to the limits in the terms of service, except where Article 82 of the GDPR or another law doesn't allow a limit.

2. 15.2

   If this agreement and the terms of service conflict on data protection, this agreement prevails. The annexes form part of this agreement. If a provision is invalid, the rest stays in force.

Nature and purpose

Screening people and companies you choose against sanctions, PEP and other watchlists; enrolling them for ongoing rescreening; recognizing a rescreen; counting your enrolled subjects for billing; and sending list-change notifications to your webhook.

Data subjects

Your customers and prospective customers, their beneficial owners, directors and related parties, and other counterparties you screen.

Personal data

Name, entity type, country, and a passport number or LEI. We keep only a keyed one-way fingerprint (HMAC) of the identifier and a random numeric reference, never a readable copy of the name or identifier. The passport number or LEI is never sent to the screening engine.

Special categories

None. PEP status is a screening outcome, not data you send.

Frequency

Continuous, for as long as you call the API.

Records and retention

Processor: ULB Media (Pty) Ltd, registration 2025/767907/07, South Africa. Data protection contact: Ruwaida Foster, information officer, privacy@onsanctions.com. Controller: the organization and account owner email on your OnSanctions account.

The authorized subprocessors are listed, with their purpose and location, on the subprocessors page.

The measures are described on the technical and organizational measures page.