Privacy
policy.

This privacy policy describes how AML Company (a Beprosoft Venture project) collects, uses, stores and protects your personal information when you use our platform.

By using AML Company, you accept the practices described in this policy. If you do not accept this policy, please do not use our services.

Identification information

• Last name, first name, email address
• Company information (name, business sector)
• Phone number (optional)

Technical data

• IP address, browser type
• Pages visited, time spent on the platform
• Login and usage logs

Client data (AML context)

• Your clients' KYC information
• Risk assessments
• Transaction history

Providing the service

• Create and manage your account
• Provide the AML features
• Deliver customer support

Improving the service

• Analyse how the platform is used
• Develop new features
• Optimise performance

Legal obligations

• Comply with AML regulations
• Answer requests from the authorities
• Keep the required records

Encryption

• AES-256 encryption at rest by Google Cloud, plus application-level encryption of integration tokens
• Secure communications over HTTPS/TLS
• Secure password hashing

Controlled access

• Multi-factor authentication
• Principle of least privilege
• Audit trail of actions on files (creation, change, approval, export)

Infrastructure

• Hosted on Google Cloud in Belgium (europe-west1 region)
• Daily encrypted backups, kept for 7 days in the European Union
• Automatic detection of application errors

We never sell your data. Sharing is limited to the following cases:

Processors and service providers

• Google Cloud (Belgium, europe-west1 region): hosting, database, document storage and backups
• Google Vertex AI (Gemini): politically exposed person search, from the name, date of birth and nationality of the person being checked; this processing is not limited to the European Union and the transfer is covered by the European Commission's standard contractual clauses (Google Cloud data processing addendum)
• Beprosoft Venture (group company): company register data, sanctions list screening from the name of the persons being checked, and PDF report generation
• Stripe: subscription payments; for identity verification (Stripe Identity), Stripe processes the identity document as a separate controller
• Amazon Web Services (SES, Paris region): email delivery
• Cloudflare: website delivery and protection (IP address, requests)
• Sentry (Germany): application error detection
• PostHog (European Union): audience measurement, linked to the name and email address for signed-in users
• Technical support (limited access)

Legal obligations

• Requests from the competent authorities
• Mandatory AML reports
• Legal proceedings

Consent

• With your explicit authorisation
• For third-party integrations

Under the GDPR, you have the following rights:

Access and rectification

• Consult your personal data
• Correct inaccurate information
• Complete incomplete data

Erasure and portability

• Ask for your data to be deleted
• Retrieve your data in a standard format
• Transfer your data to another service

Objection and restriction

• Object to the processing of your data
• Restrict the use of certain data
• Withdraw your consent

Account data

• For as long as the service is used
• 3 years after the account is closed

AML data

• 10 years from the end of the business relationship or of the occasional transaction, for identification data and due diligence measures (art. 60 of the Belgian Act of 18 September 2017)
• Once that period ends, the law requires their erasure, unless another statutory obligation applies (art. 62 of the same Act)

Technical logs

• 30 days for server technical logs (IP address, requests)
• Audit trail of actions on files: currently kept with no time limit

Essential cookies

• Authentication and security
• Interface preferences
• Running the platform

Analytics cookies

• Audience measurement (PostHog, hosted in the European Union)
• Improving the user experience
• Detecting technical problems

Data protection officer

• Email: [email protected]
• Phone: +32 (0)2 503 41 49
• Answer within 72 hours at most

Complaints

• Contact us first at [email protected]
• Belgian supervisory authority: APD/GBA
• European Commission for cross-border disputes

Notifications

• Email sent 30 days before any major change
• Notice inside the platform
• Archived version available on request

Types of change

• Clarifications with no impact on your rights
• New features with stronger protection
• Regulatory developments