Privacy policy
Last updated November 9, 2026
This policy explains how ULB Media (Pty) Ltd, which runs OnSanctions, handles personal data: what we process, why, on what legal basis, who receives it, where it goes, how long we keep it, and the rights you have. It applies to onsanctions.com, the OnSanctions API, the MCP server and quick check.
Questions or requests: privacy@onsanctions.com.
1. Introduction and laws
We apply the EU General Data Protection Regulation (GDPR) and UK GDPR as our baseline for everyone, and also comply with South Africa's Protection of Personal Information Act (POPIA), US state privacy laws including the CCPA/CPRA, Brazil's LGPD, Canada's PIPEDA and the Australian Privacy Principles where they apply.
"Personal data" means any information about an identified or identifiable person. "Processing" means anything done with it, such as collecting, storing, using or deleting it.
2. Who is responsible
The controller (the "responsible party" under POPIA) is ULB Media (Pty) Ltd, registration 2025/767907/07, South Africa. Company details are in the legal notice.
Our information officer under POPIA is Ruwaida Foster, at privacy@onsanctions.com. We have not appointed a data protection officer under the GDPR, because we are not required to.
3. How our processing is organized
We handle personal data in two different roles:
- As controller, for people who visit our website, hold an account, buy quick checks or contact us. Section 4 covers this.
- As processor (the "operator" under POPIA), for people our customers screen through the API. The customer is the controller, and we act only on its instructions under our data processing agreement. Section 5 covers this.
OnSanctions runs on Cloudflare's network. Account data is stored in Cloudflare D1, restricted to the European Union. Screening runs at our screening engine, VerifyNow, in South Africa. Section 7 explains transfers.
4. Processing in detail
For each activity where we are the controller:
Visiting the website
| Data | IP address, browser and device details, the page requested, time, and referring page. |
|---|---|
| Purpose | Deliver the site, keep it secure, and prevent abuse, fraud and overload. |
| Legal basis | Legitimate interests in running a secure website (GDPR Art. 6(1)(f)). |
| Kept for | Request metadata is kept by Cloudflare for its security functions under its own retention; we don't keep website access logs. |
| Recipients | Cloudflare. |
Accounts and team members
| Data | Organization name, member names and emails, password hash, role, invites, and sign-in records. |
|---|---|
| Purpose | Create and run your account, sign-in and team access, and contact you about the service. |
| Legal basis | Contract (Art. 6(1)(b)). |
| Kept for | While the account is open, then deleted within 30 days. Invites expire after 7 days. |
| Recipients | Cloudflare (storage in the EU). |
Using the API
| Data | API key hashes, IP allowlists, webhook URL and secret, and a call log of time, key prefix, route, status and request ID. No names or identifiers. |
|---|---|
| Purpose | Authenticate calls, enforce limits, bill usage, send list-change notifications, support you, and give you an audit trail. |
| Legal basis | Contract; legitimate interests in security and abuse prevention. |
| Kept for | Call and webhook delivery logs for 30 days; idempotency records for 48 hours; keys until revoked or the account ends. |
| Recipients | Cloudflare (storage in the EU). |
Quick check
| Data | The name you search, its type and optional country; the pack you bought and checks used; your email, collected by Stripe at checkout. |
|---|---|
| Purpose | Run the screen you asked for, take payment, send the receipt and keep your paid checks available. |
| Legal basis | Contract (your request). |
| Kept for | The searched name is screened and shown, not stored. Pack records for one year from purchase. |
| Recipients | VerifyNow (screening), Stripe (payment), Cloudflare. |
Payments and invoicing
| Data | Stripe customer ID, plan, invoices, tax ID and billing address. Card details stay with Stripe. |
|---|---|
| Purpose | Charge for plans and quick checks, prevent payment fraud, and meet tax and accounting duties. |
| Legal basis | Contract; legal obligation (Art. 6(1)(c)). |
| Kept for | While the account is open, then as long as tax and accounting law requires, usually five to seven years. |
| Recipients | Stripe. |
Email and support
| Data | Your name, email address and what you write to us. |
|---|---|
| Purpose | Answer you, and handle complaints, requests and legal claims. |
| Legal basis | Legitimate interests in answering enquiries; contract where you are a customer. |
| Kept for | As long as needed to resolve the request, and at most three years after the last message, unless a claim requires longer. |
| Recipients | SiteGround (email hosting). |
Cookies
| Data | Four first-party cookies: session, currency, one-time secret display and quick check pass. |
|---|---|
| Purpose | Keep you signed in, remember your currency, and keep your paid checks available. |
| Legal basis | Strictly necessary for a service you asked for (ePrivacy Directive Art. 5(3) exemption); no consent needed. |
| Kept for | From 10 minutes to one year; see the cookie policy. |
| Recipients | None. |
We don't use analytics or advertising tools, don't sell or rent personal data, don't share it for advertising, and don't make automated decisions about you that have legal or similarly significant effects.
5. People screened by our customers
Customers screen their own customers and counterparties against sanctions, PEP and other watchlists, usually to meet anti-money laundering and sanctions laws. They send a name, entity type, country and an identifier (passport number or LEI).
We never keep a readable copy of the name or identifier. We keep a keyed one-way fingerprint of the identifier and a random numeric reference, so we can recognize a rescreen and count the customer's active subjects. The passport number or LEI is never sent to the screening engine. VerifyNow holds the name and our reference as keyed digests while the subject is enrolled, and keeps encrypted full responses for 48 hours. Enrollment audit metadata is kept for seven years after withdrawal, so customers can meet record-keeping duties.
We don't decide anything about the people screened. A result shows possible list matches; the customer reviews them and decides. If you were screened by one of our customers, contact that business first. We will pass on any request we receive about it.
The sanctions and PEP data itself comes from public authorities and data providers through our screening engine. To correct or challenge a listing, contact the authority that published it.
6. Recipients
We share personal data only with these service providers, each bound by a data processing agreement:
- Cloudflare: hosting, network security and storage in the European Union.
- VerifyNow, Cape Town, South Africa: the screening engine.
- Stripe: payments, invoices and tax IDs.
The current list is on the subprocessors page. We may also disclose data where the law requires it, to protect our rights or users, or to a buyer of our business, which would be bound by this policy.
7. International transfers
We are based in South Africa and serve customers worldwide. Account data is stored in the European Union; screening runs in South Africa; Stripe processes payments in several countries, including the United States.
When personal data leaves the European Economic Area, the United Kingdom or Switzerland for a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments where they apply), or on a provider's certification under the EU-US Data Privacy Framework. Transfers out of South Africa follow section 72 of POPIA. Email privacy@onsanctions.com for a copy of the safeguards.
8. Security
All traffic is encrypted in transit, passwords are hashed with bcrypt, API keys are stored only as hashes, and access to production systems is limited. The full list is in our technical and organizational measures. If a breach affects your data, we will tell you and the relevant authority as the law requires.
9. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- have your data deleted;
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, where we rely on it;
- not be subject to decisions based solely on automated processing;
- complain to a data protection authority.
Email privacy@onsanctions.com. We answer within one month (45 days under US state laws), may need to verify your identity, and may extend once where the law allows. An authorized agent can make a request for you with your signed permission. You won't be treated differently for using your rights. If we decline a request, we will explain why and how to appeal.
10. Region-specific information
European Economic Area, United Kingdom and Switzerland. You can complain to your local data protection authority (in the UK, the Information Commissioner's Office), though we would welcome the chance to help first.
United States, including California. In the last 12 months we collected identifiers (name, email, IP address), commercial information (purchases and plans) and internet activity (API and website logs), for the purposes in section 4. We don't sell or share personal information for cross-context behavioral advertising, and don't use sensitive personal information to infer characteristics. Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states can use the rights in section 9.
South Africa. You can complain to the Information Regulator (inforegulator.org.za). Our PAIA manual explains how to request records.
Brazil. The legal bases under the LGPD are contract performance, legal obligation and legitimate interests. Our information officer acts as the encarregado at privacy@onsanctions.com. You can complain to the ANPD.
Canada, Australia and elsewhere. We apply this policy to everyone, consistently with PIPEDA and the Australian Privacy Principles. You can complain to the Office of the Privacy Commissioner of Canada, the OAIC or your local regulator.
11. Children
OnSanctions is a business service and is not meant for anyone under 18. We don't knowingly collect data from children.
12. Changes to this policy
We update the date at the top when this policy changes, and email account owners before a material change takes effect.