Privacy policy
Updated:
Draft text, legal review in progress.
Who we are
KYC ATLAS is published by KYC ATLAS (144 Z.A.E. Wolser A, L-3225 Bettembourg). For any question about your data: contact@kycatlas.com. Data protection contact: Noah LANFRIT - noah.lanfrit@kycatlas.com.
Two different roles
- For this website and for user accounts in the application, we are the controller.
- For the KYC files our clients build in the application (their clients, beneficial owners, documents, screening), the professional using KYC ATLAS is the controller; we act as a processor within the meaning of Article 28 GDPR, only on their instructions and under a data processing agreement.
If your data is in a professional’s KYC file, address your requests to that professional: they decide how it is used.
Data we process
Website visitors. Only with your consent, the website measures its traffic with Google Analytics (_ga cookies, details on the cookie page); without it, it sets no cookies. Without cookies, it also counts every visit with Umami, a tool we host ourselves: page viewed, referring site, browser, device, language, and the country, region and city derived from the IP address, which is not kept; you can object to it on the same page. The server keeps technical logs (IP address, date, page requested) for security and troubleshooting, for 90 days.
User accounts. Name, email address, role, organisation, password (hashed, never readable), log of sign-ins and actions.
KYC files. Identity of the parties, supporting documents, ownership structure, source of funds, screening results, assessments and decisions, entered by our clients or by their own clients through the portal.
Access requests and correspondence. The information you send us through the form or by email.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service to our clients | Performance of the contract |
| Enabling our clients to meet their anti-money laundering obligations | Legal obligation of the client (controller) |
| Securing the service, preventing fraud, keeping the audit trail | Legitimate interest |
| Answering your requests and getting back to you | Legitimate interest, or pre-contractual steps |
| Counting site visits without cookies (Umami) | Legitimate interest |
| Measuring site traffic (Google Analytics) | Consent |
Sub-processors
| Sub-processor | Role | Data concerned |
|---|---|---|
| [À COMPLÉTER] | Hosting of the servers and backups | All data of the service |
| Anthropic (United States) | AI processing: reading documents, analyses, memo draft, assistant | Documents and data of the files concerned |
| Resend (United States) | Sending the service’s emails | Email address, name, access link |
| Google (Places API) | Address suggestions while typing | Text of the address typed |
| Google (Analytics) | Site traffic measurement, with your consent | Pages viewed, a random identifier, browser and device information |
| Public search engines, queried through our self-hosted meta-search | Adverse media searches during screening | Name of the person screened |
Transfers outside the European Union: Anthropic, Resend and Google may process this data in the United States. These transfers rely on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), built into each provider’s terms. Resend and Google are also certified under the EU–US Data Privacy Framework.
Retention
- User accounts: for the duration of the contract, then deleted when it ends, unless the law requires otherwise.
- KYC files: as instructed by the client. Anti-money laundering law generally requires documents and analyses to be kept for five years after the end of the business relationship or the date of the occasional transaction.
- Backups: 14 daily, 8 weekly, 12 monthly and 6 yearly backups, then erased.
- Audience measurement: cookies at most 13 months; data in Google Analytics at most 14 months, then deleted.
- Visitor statistics (Umami): 25 months, then deleted.
Security
Documents encrypted at rest, strict isolation between organisations, hash-chained audit trail, encrypted backups: the details are on the Security page.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. Write to contact@kycatlas.com; we answer within one month.
You can also lodge a complaint with a data protection authority, including:
- Belgium: Data Protection Authority
- Luxembourg: Commission nationale pour la protection des données
- Netherlands: Autoriteit Persoonsgegevens