Data processing terms

1. Who is who

When you keep your clients in Stratum, check them, upload their documents, or collect their details through a details link or an ID check, your firm is the controller of that personal data and Stratum is your processor: we process it only to provide Stratum to you. Stratum is a trading name of Amir Naghieh, 3 Pembroke Road, London, HA4 8NQ, United Kingdom, registered with the Information Commissioner’s Office as ZC273024.

These terms form part of our terms of service and set out what UK GDPR Article 28 requires. How we handle your own team’s details (as controller) is in our privacy notice.

2. What we process, and why

Purpose: keeping your client register (your clients, the people behind them, tasks, notes, documents and each client’s timeline); running the checks you ask for (sanctions, PEP, company, owners, directors, the disqualified directors register, the FCA register and a risk score); watching your clients every morning (the sanctions lists, Companies House and your deadlines) and telling your team what changed; the details links you send your clients; and your records (certificates, the audit trail, the inspection bundle).

Whose data: your clients and the people connected with them (directors, owners, people acting for a company), and anyone else you add.

What data: names, dates of birth, nationality, home addresses, the email addresses and phone numbers you add, company roles and holdings, check results, possible matches and your decisions on them, risk levels and your reasons, notes, tasks, the documents you upload, and the details your clients send through a details link. Some results may include information about criminal offences (sanctions listings). For an ID check by link, the identity service’s report, which can include a copy of the document and a still image from the selfie; the face matching (biometric data) is done by the identity service, and we keep its report, not any biometric template.

How long: while you use Stratum, then for the periods in section 6.

3. What we commit to

• We act only on your instructions: using Stratum as it is designed, your settings, and these terms. If the law requires us to do something else, we tell you first unless the law forbids it.
• Everyone who can access your data is bound by confidentiality.
• We keep it secure: encrypted in transit and at rest, stored in London, reachable only by your signed-in team, with documents uploaded and downloaded through links that expire within ten minutes, access keys limited to what each part needs, and logging that alerts us to errors.
• We help you answer your clients’ requests (access, correction, deletion) and help with your security, breach and impact assessment duties.
• We tell you without undue delay, and within 48 hours of finding out, if a personal data breach affects your data.
• We give you the information you need to show these terms are kept, and allow a reasonable audit (once a year on 30 days’ notice, or after a breach).
• When you stop using Stratum, we delete or return your data as section 7 says.

4. The companies we use (sub-processors)

You authorise us to use these companies for your clients’ data. Each is bound by written data protection terms that protect your data as these terms do, and we stay responsible to you for them. We will email you at least 14 days before a new company starts processing your clients’ data, so you can object.

Company details come from Companies House, the public register: we send it company numbers, never your clients’ personal details. Where data is processed outside the UK, we rely on the UK’s adequacy regulations (the EU) or the UK International Data Transfer Agreement or Addendum (elsewhere).

5. What you commit to

You have a lawful reason for each check and each record (usually the Money Laundering Regulations), you tell your clients that you use Stratum and its partners for these checks, you only add the data your work needs, and your instructions to us are lawful.

6. How long records are kept

• Clients you act for (their details, people, checks, certificates, documents, notes and timeline): while they are in your register.
• Clients you archive: five years from the day you archive them, then deleted. The Money Laundering Regulations ask you to keep due diligence records for five years after the business relationship ends and then to delete the personal data (regulation 40). You can delete an archived client sooner.
• ID check reports (the photo and ID image): for a client in your register, deleted with the client, and in any case 6 years after the check; through the Transactions API, until 5 years after you mark the job complete, or 6 years after the check if it is never marked complete, then deleted.
• A certificate’s public verify record holds no client details: your firm’s name, your own reference if you gave one, when it was issued and which checks ran.
• Deleted data leaves our backups within 35 days.

7. When you stop using Stratum

You can download your audit trail, certificates and documents first. Then, as you choose: we delete your clients’ data within 30 days of your written instruction, or keep it for the periods in section 6 so it stays available to you if your supervisor asks.

8. Contact

Data protection questions, requests and breach reports: dpo@stratumapis.com.