Privacy Policy
This policy explains what personal data the ofacscanner.com service collects, why, how long it is kept, who receives it and how you can use your rights. In short, we collect only what the service needs, set only necessary cookies and never sell data.
Who is responsible for your data
This policy describes how the administrator of the ofacscanner.com service ("we", "us") handles personal data when you visit the website, create an account or use the OfacScanner sanctions screening service. You can reach the administrator at [email protected] for any question about privacy.
We act in two roles. For data about our own visitors and account holders we decide why and how it is processed. For the names and details our customers screen, the customer decides what to screen and why, and we process that data on the customer's behalf and on its instructions.
What data we collect
We collect only what the service needs:
- Account data: your email address, a password stored as a one-way hash, your name if you add it, your workspace name and your role.
- Billing data: the plan, billing period and invoices. Card details are entered on the payment operator's checkout page and never reach our servers.
- Screening data: the names, dates of birth, countries, identifiers and references you or your systems send for screening, the results, case notes and decisions.
- Technical data: IP address, browser type, the pages and features you use, timestamps and error logs, kept to run, secure and debug the service.
- Messages: what you write to [email protected] and our replies.
Why we use it and on what legal basis
We use personal data to provide the service you signed up for (performance of a contract), to send login codes, alerts and receipts (performance of a contract), to keep the service secure, prevent abuse and improve features (our legitimate interests), and to keep accounting and tax records (legal obligation).
Screening data is used only to screen, monitor, store evidence and produce the reports the customer asks for. We do not use it for advertising, we do not sell it and we do not combine it into any list or database for other customers.
Cookies and similar technology
The website and the app set only strictly necessary cookies: a session cookie that keeps you logged in, a security token that protects forms against cross-site request forgery, and a small preference such as your chosen billing period. Because these cookies are required for the service to work, no consent banner is shown.
We do not use advertising cookies, tracking pixels or third party analytics cookies. Aggregate usage statistics, where we keep them, are produced from our own server logs without cookies.
Who receives data
We share personal data only with service providers that help us run OfacScanner, each bound by a data processing agreement and limited to its task:
- a hosting provider with data centers in the United States or the European Union, which stores the application and its encrypted databases,
- a payment operator, which processes subscription payments and receives your billing name, email and card details,
- an email delivery provider, which sends login codes, alerts and receipts.
We may disclose data when the law requires it, for example to answer a valid order from a court or authority. We never sell personal information and we never share it for cross-context behavioral advertising.
International transfers
Customers may be located anywhere, and our providers may process data outside the country where you live. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the standard contractual clauses approved by the European Commission or an equivalent safeguard. Enterprise customers can choose to keep workspace data in the United States or the European Union.
How long we keep data
Account data is kept while your account is open and deleted within 90 days after it closes, except records we must keep for tax and accounting. Screening evidence and audit records are kept for the retention period of your plan, 12 months on Starter and 5 years on Growth and higher, unless the customer asks us to delete them earlier. Technical logs are kept for a short period needed for security, usually no longer than 90 days.
Your rights
Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format and withdraw consent where processing is based on consent. Residents of US states with privacy laws, such as California, have the right to know, delete and correct personal information and the right not to be discriminated against for using these rights.
Send any request to [email protected]. We answer within one month. If you were screened by one of our customers, we pass your request to that customer, because it decides about that data. You also have the right to complain to your local data protection authority.
How we protect data
We use encryption in transit and at rest, role based access, an audit log of actions, one-way hashing of passwords and API keys, and signed webhooks. More detail is on our security page.
Children
OfacScanner is a business service. It is not directed to children, and we do not knowingly collect data from anyone under 16 as an account holder.
Changes to this policy
When we change this policy we publish the new version on this page. If a change materially affects how we use your data, we tell account holders by email before it takes effect.