Draft — pending legal review. This text is a draft prepared for legal review. It is not final, it may change before ARCA Sanctions is offered commercially, and the passages marked as pending have yet to be completed by ARCA Compliance.
Privacy policy
This policy explains what ARCA Sanctions stores, why, how it is protected and for how long. The Customer that screens is the controller of the data of the subjects it submits; ARCA Compliance processes those data on its behalf to provide the Service.
1. What we store
Screened subjects: names and aliases, entity type, dates of birth, nationalities and countries, identification document numbers and the Customer's own reference, exactly as the Customer submits them in a search, a batch, the API or the register of subjects.
Results and decisions: the hits found, their scores and evidence, the decisions taken with their narratives, the exceptions, assignments and certificates, and the monitoring state of each registered subject.
Batch files: the file uploaded and its rows, kept while the batch is processed (see Retention).
Account and usage data: the people who sign in through the ARCA Compliance platform, their actions in the Service and technical logs.
Reference data: the sanctions lists, which are public data published by governments and international bodies, stored as published; PEP data from a third-party source whose licence is [PENDING: PEP data licence].
2. Why
To screen the subjects the Customer submits, to let it review and decide hits and keep the evidence its auditors and regulators may ask for, to monitor registered subjects when a list changes, to operate and secure the Service and to meet legal obligations. We do not use these data for advertising, we do not sell them and we never use one Customer's subjects to screen for another.
3. Protection
Data are encrypted in transit (TLS); encryption at rest is being implemented. Each organization's data are kept apart and reached only by its own members, according to their roles. Decisions are written to a chained ledger whose integrity can be checked. People are authenticated by the ARCA Compliance platform.
4. Retention
Searches, results, decisions and certificates are kept for at least 5 years from the search or the decision, the period regulators commonly require; the Customer may configure a longer period in Settings. The raw rows of a batch file can be purged once the batch has finished [PENDING: purge period], while its results and its certificate stay with the rest of the screening record. Technical logs are kept for [PENDING: log retention period].
5. Sub-processors
The Service runs on cloud infrastructure and uses email delivery and error-monitoring providers. The list of sub-processors is [PENDING: list of sub-processors] and is updated before a new one handles Customer data. Data are hosted in [PENDING: hosting region].
6. The lists and listed people
The sanctions lists are published by public authorities; the Service reproduces them as published, with the date and hash of each release. A person who believes a list contains an error about them should contact the authority that publishes it. Requests about the PEP source will be handled as set out when its licence is settled [PENDING: PEP data licence].
7. Your rights and contact
A person screened by a Customer should address requests to access, correct or delete their data to that Customer, as controller; if they reach us, we forward them. Within the limits of the minimum retention, requests from the Customer or about account data go to [PENDING: contact email]. We answer within 30 days.
8. Cookies
The Service sets only a language cookie and keeps the sign-in session in the browser's storage. It uses no advertising or third-party tracking cookies.
9. Changes
Changes to this policy are announced in the Service or by email before they take effect, with the date of the last update shown at the top.