ComplyAdvantage: Privacy Notice

The pages you visit, the means you use to visit (browser version, time zone, operating system, etc.), how long your visits last and how long you spend on each page, the frequency of your visits, and information on how you navigate and interact with the site.

Data that identifies you

Your IP address, unique identifiers tied to cookies.

Analysing aggregated data to update our site’s content and layout to improve relevance for visitors. 

Using insights from visitor behaviour to improve the way we market our Services and our website. 

• Personal data will be available for our global marketing teams, and other ComplyAdvantage personnel who have a need to access this data for the purposes set out above.

Outside of ComplyAdvantage

• client relationship management and marketing automation providers,
• website analytics vendors.

The pages you visit, the means you use to visit (browser version, time zone, operating system, etc.), how long your visits last and how long you spend on each page, the frequency of your visits, and information on how you navigate and interact with the Services.

Data that identifies you

Your IP address, unique identifiers tied to cookies, and the name and contact details used by you to access the Services.

Analysing aggregated data to update our site’s content and layout to improve relevance for Users.

Service updates and notifications

Communicating with you about changes to the Services, availability of the Services, and your organisation’s activity on the Services. Sharing with you content and tutorials about the Services.

Security and logging

Monitoring and analysing login and session data to detect anomalous and potentially unauthorised use of your account.

• Ensuring that User accounts are appropriately secured,
• Keeping Users informed of important updates to their account,
• Providing the Services contracted for with the organisation through which the User is authorised to use the Services,
• Using insights from User behaviour to improve the way we design our Services and website,
• Acting on support requests involving a User.

• Information required to operate a User’s account is deleted following the termination of ComplyAdvantage’s relationship with the organisation through which a User receives access,
• Logs are stored for 30 days,
• Analytics data are stored for 36 months, 
• Support and related correspondence details are stored for six years,
• Data holding periods for cookies, local storage or similar technologies are determined by their expiry times.

• ComplyAdvantage personnel who have a need to access the data for the purposes set out above.

Outside of ComplyAdvantage

• Vendors used by ComplyAdvantage to host the Services,
• Website and service analytics vendors,
• Email automation vendors,
• Support and client relationship management vendors.

This information is added to and managed through our contact database. A member of our sales team may contact you if we determine through your submission that you may be interested in our Services. We analyse our contact database data to understand, track, and improve how we market and sell our Services.

If you request that we contact you to provide more information on our Services to you, we’ll process your data and contact you on this basis.

Legitimate interests

We will send you our email newsletters being necessary for our legitimate interests to give you information about our Services (unless you have opted-out). We’ll also retain and analyse information gained from our interactions with you as part of understanding, tracking and improving how we market and sell our Services.

We retain a record of your marketing preference choices in order to demonstrate our historic compliance with data protection law.

Consent

We may ask you for your consent to process your personal data, for example to send you marketing communications when you sign up to receive one of our industry reports. You are able to revoke this consent at any time by unsubscribing using the automated unsubscribe button in our emails.

We’ll keep your details on this list until you unsubscribe, at which point we’ll move your details to an opted-out list to ensure that we don’t send you marketing emails in future.

Sales process

We retain information relating to our sales interactions with you for up to five years following our determination that we’re not currently an appropriate sales fit. Sales cycles in our market are long, so a prospect we don’t pursue now may become a real opportunity later. This period lets us pick the conversation back up rather than starting cold.

General

We retain historic information relating to any marketing preference choices that you provided, or other bases for processing that have since lapsed, for six years from the date that the basis for processing lapsed.

Personal data will be available for our sales team, marketing team, client success and other teams as necessary to fulfil the purposes set out above.

Outside of ComplyAdvantage

Our cloud storage providers, contact database, and marketing providers.

• Contact you in relation to your candidacy,
• Assess suitability for future vacancies,
• Assess your suitability for the vacancy you applied for,
• Monitor the impact of our diversity and inclusion programme and to make improvements.

If you send us your personal data in response to a vacancy advertised by us, we need to process it in order to consider your application.

Legitimate interests

We want to build the best team we can, and we carry out this processing as part of the hiring process that enables this.

Compliance with a legal obligation

Where we sponsor a worker for a role you applied for, we retain unsuccessful applicant information as part of the related immigration record-keeping requirements.

Diversity monitoring

Providing equality information (such as your racial or ethnic origin) is voluntary. Where you do, we process it solely to monitor and promote equality of opportunity and treatment, in aggregated form and not for any decision about you, under the equality of opportunity or treatment condition in Schedule 1 to the Data Protection Act 2018. You can ask us to stop at any time.

Your information is stored in our applicant tracking system for up to 24 months after you have been notified your application has been unsuccessful. We may process this data for instance for the purpose of defending any claims against us. Successful candidates’ information becomes subject to our Employee Privacy Notice.

Legal record-keeping

Where we sponsor a worker for a role you applied for, we’ll retain your personal data until the expiry of the applicable record-keeping requirement under UK immigration rules (currently up to one year following the end of our sponsorship of that worker).

Personal data will be available for the hiring and recruitment teams.

Outside of ComplyAdvantage

• Our applicant tracking system,
• Providers of any aptitude testing systems used as part of the hiring process,
• Third party background check providers,
• Recruitment agencies.

• Publicly available information relevant to your potential suitability to work with ComplyAdvantage,
• Any information provided by someone else about you to us,
• Feedback from interviews and assessments.

• Contact you in relation to current vacancies,

• Assess your suitability for vacancies.

• Assessing the current labour market and your suitability for available roles,
• To hold as a reference point should you make any further applications within the retention period.

Compliance with a legal obligation

Where we sponsor a worker for a role you applied for, we retain unsuccessful applicant information as part of the related immigration record-keeping requirements.

• Personal data will be available for the hiring team and our recruitment personnel.

Outside of ComplyAdvantage

• Our applicant tracking system,
• Providers of any aptitude testing systems used as part of the hiring process,
• Our cloud file storage systems,
• External recruiters with whom you dealt as part of the recruitment process,
• Government and legal service providers involved in the visa application process,
• Third party background check providers.

Information related to and available on publicly available government lists covering sanctions, the prevention and detection of unlawful acts, and other protective functions. This will generally include a full name, a year or date of birth, nationality, reasons for appearing on the list, and the period covered by the data subject’s appearance on the list, but this depends on the information contained in the list.

Politically exposed persons

We collect publicly available information relating to individuals in prominent public positions, and their family members, close associates, and business interests. Names, dates or years of birth, position(s) held or connection(s) that we think may give rise to a PEP designation, country of nationality, residence and service, photographs (if available) and the period for which that designation would have been active (e.g. active service dates).

Adverse media

We collect links to publicly available news articles that our systems determine to name individuals in connection with financial crime, terrorist financing, other relevant unlawful acts, improper conduct, dishonesty, etc. We will also extract information relating to age from these articles to determine approximate years of birth.

Corporate registry information

We collect data from publicly available corporate registries or from third parties, relating to individuals’ shareholdings and directorships (or such analogous positions).

We structure the data collected into profiles consolidating the information outlined above.

Sharing with clients

Where one of our clients searches for a name on our database, we share with that client any profiles that match the given search parameters.

Partners

We will also share this data with partners that resell the data to clients seeking AML and sanctions compliance tools.

Our existing and prospective clients have legitimate interests in gaining access to high-quality and easily manageable data of the type we process in order to optimise compliance with obligations concerning sanctions, anti-money laundering, know-your-client and counter-terrorist financing. We also pursue our own legitimate interests in providing the Services to our clients, developing and improving the Services to serve that market.

Where this information includes special category data or personal data relating to criminal convictions and offences, we process it as necessary for reasons of substantial public interest under Schedule 1 to the Data Protection Act 2018, in particular for the prevention, investigation or detection of unlawful acts, dishonesty and financial crime (Article 9(2)(g) UK GDPR for special category data; section 10 of, and Schedule 1 to, the Data Protection Act 2018 read with Article 10 UK GDPR for criminal conviction and offence data). In respect of special category data, we may also rely on such information having been manifestly made public by the data subject (Article 9(2)(e) UK GDPR). Where equivalent or analogous provisions of other applicable data protection laws apply, we rely on the corresponding conditions under those laws.

We hold this data for as long as it is necessary to fulfil the purposes for which it was collected. This includes any legal, accounting, or reporting requirements. To determine the appropriate retention period for the personal data, we consider the amount, nature, and sensitivity of that data, the potential risk of harm from unauthorised use or disclosure of the personal data, the purposes we process that personal data for and whether we can achieve those purposes through other means.

Backups

Where we remove personal data from this database (for example, where we become aware that the information is not, or is no longer, relevant), it will remain in our backups for 30 days.

• Clients (independent data controllers) who subscribe to our database.
  We may also act as a data processor when these clients instruct us to screen their own customer data against our database. However, we remain a data controller of the anti-money laundering, sanctions and adverse media data itself. 

• Partners who resell access to our database to their own clients.
  As with direct clients, we are the controller of the anti-money laundering, sanctions and adverse media data itself. Where we screen a client’s own customer data on instruction, we act as a sub-processor (or, where the partner is not in the data chain and the client instructs us directly, as a processor).

• ComplyAdvantage group employees,
• Our hosting and cloud storage providers,
• Vendors we use to monitor the accuracy and performance of the data.

This information, along with details of our interactions including phone calls and correspondence, is added to, and managed through, our client relationship management tools. We analyse our client relationship management data to understand, track, and improve how we market and sell our Services. We save some correspondence to provide precedents and examples to other members of the team, and add your personal data to our e-signing and billing systems if appropriate.

We may make recordings of telephone calls with clients and prospective clients.

We may send you questionnaires or forms asking for feedback on our Services, which are used to help improve the Services we provide.

If you request that we contact you to provide more information on our Services to you, we’ll process your data and contact you on this basis.

Legitimate interests

We’ll retain and analyse information gained from our interactions with you as part of understanding, tracking and improving our Services and how we market and sell our Services.

We process data in relation to billing and contracting in order to operate the legal and financial elements of our business.

We retain records of consent-based and other processing in order to demonstrate our historic compliance with data protection law.

We’ll keep your details on this list until you unsubscribe, at which point we’ll move your details to an opted-out list to ensure that we don’t send you marketing emails in future.

Sales process

We retain information relating to our sales interactions with you for up to five years following our determination that we’re not currently an appropriate sales fit. Sales cycles in our market are long, so a prospect we don’t pursue now may become a real opportunity later. This period lets us pick the conversation back up rather than starting cold.

General

We retain historic information relating to any consent you provided, or other bases for processing that have since lapsed, for six years from the date that the basis for processing lapsed.

Personal data will be available for our marketing and sales personnel, as well as client success and other teams as necessary to fulfil the purposes set out above.

Outside of ComplyAdvantage

Our cloud storage providers, client relationship management, sales and marketing automation tools, third party providers of online forms, client support/servicing tools, debt collection service providers.

Your name, contact details, and the contents of your messages.

• Replying to your queries,
• Improving our Services and the related content.

• Name, contact details, professional activity,
• Publicly available information relevant to your position in your organisation, and industry events you’re attending,
• Bought in data from third party providers (containing the above-mentioned data).

A member of our sales team may contact you to understand more information about your organisation’s anti-money laundering and sanctions compliance operations, and gauge your organisation’s potential interest in our Services.

This information, along with details of our interactions including phone calls and correspondence, is added to, and managed through, our contact database. We analyse our contact database data to understand, track, and improve how we market and sell our Services.

If you subsequently request that we contact you to provide more information on our Services to you, we’ll process your data and contact you on this basis.

Legitimate interests

• Identifying stakeholders in organisations with requirements for software similar to that provided by ComplyAdvantage,
• To retain as a reference point in case a future opportunity arises within the retention period,
• We’ll retain and analyse information gained from our interactions with you as part of understanding, tracking and improving how we market and sell our Services.

We retain information relating to our sales interactions with you for up to five years following our determination that we’re not currently an appropriate sales fit. Sales cycles in our market are long, so a prospect we don’t pursue now may become a real opportunity later. This period lets us pick the conversation back up rather than starting cold.

General

We retain historic information relating to any consent you provided, or other bases for processing that have since lapsed, for six years from the date that the basis for processing lapsed.

Personal data will be available for our marketing and sales personnel, as well as client success and other teams as necessary to fulfil the purposes set out above.

Outside of ComplyAdvantage

Our cloud storage providers, client relationship management, sales and marketing automation tools, and client support/servicing tools.

We may make recordings of telephone calls with suppliers and prospective suppliers.

We may send you questionnaires or forms asking for further information on how you or your employer provide services, which are used to facilitate our supplier management and to comply with our governance obligations.

As part of receiving services from you or your employer, we will process personal data concerning employees of the supplier, that are necessary for assessing the suitability of the supplier, or for the purposes of receiving the services.

We’ll process your data as part of considering if we wish to enter into a supplier relationship with you/your employer, and subsequently to facilitate the receipt of services from the supplier, to comply with our ongoing supplier governance processes and processing invoices.

Legitimate interests

We also rely on our legitimate interests where we process data about our suppliers’ employees, who are not parties to our contract.

Personal data will be available for personnel, as necessary to fulfil the purposes set out above.

Outside of ComplyAdvantage

• Our cloud storage providers,
• Client relationship management,
• Finance tools (for example to generate purchase orders),
• Third party providers of online forms,
• Ticketing systems,
• File and office management tools.