Privacy Policy

Last updated: 24 May 2024

AutoKYC provides a SaaS orchestration platform and managed onboarding operations to regulated institutions. We designed the platform to minimise personal data, maintain explicit audit trails, and respect the rights of individuals subject to onboarding, ongoing due diligence (ODD), and enhanced due diligence (EDD) workflows.

1. Data controller and contact

AutoKYC Technologies Ltd. (AutoKYC, we, us) acts as:

• Processor when delivering SaaS capabilities on behalf of customers;
• Sub-processor for managed operations partners that contract directly with the customer; and
• Controller for our marketing website and product analytics once consent is granted.

Questions, privacy requests, or security disclosures can be sent to privacy@autokyc.com or by post to our registered office at 5 New Street Square, London EC4A 3TW, United Kingdom.

2. Personal data we process

We avoid storing biometric templates. When required for jurisdictional compliance, templates are encrypted client-side and retained only for the minimal legal term.

3. Purposes and lawful bases

• Contract performance – Provision of SaaS features, SDKs, and managed operations activity.
• Legal obligation – Record retention for AML regulations, cooperative engagement with competent authorities.
• Legitimate interest – Service hardening, threat detection, product telemetry in a pseudonymised state.
• Consent – Marketing communications, optional analytics, recruitment pipelines.

We document lawful bases in the customer-specific Data Processing Addendum (DPA), and configurability inside the platform ensures the customer can align with local regulators.

4. Sharing and international transfers

AutoKYC only shares data with:

• Customer-selected data providers (identity, AML, sanctions, business registries);
• Infrastructure partners (Cloudflare, AWS, Snowflake) under data processing agreements;
• Managed operations facilities that adhere to ISO 27001, SOC 2 Type II, and regional labour requirements.

Cross-border transfers rely on Standard Contractual Clauses (2021/914/EU), UK IDTA addendums, and Transfer Impact Assessments. Customers can request region locking for data storage and case handling.

5. Security and privacy by design

• Transport encryption via TLS 1.2+ and HTTPS Strict Transport Security (HSTS).
• Encryption at rest (AES-256) with envelope key management and quarterly rotation.
• Fine-grained roles with least privilege, enforced MFA, and time-bound access for support staff.
• Immutable audit logs covering API calls, rule changes, analyst actions, and exports.
• Data minimisation tooling such as selective redaction, timed retention, and access attestations.

AutoKYC maintains ISO 27001 certification and completes annual SOC 2 Type II audits covering both SaaS and managed services.

6. Data subject rights

Individuals can:

• Access the personal data processed about them;
• Correct inaccuracies;
• Delete data when legal grounds allow;
• Restrict processing under certain conditions;
• Object to processing carried out on legitimate interest grounds; and
• Port data provided to us in a structured format.

Requests are logged in our privacy portal and forwarded to the relevant customer when AutoKYC acts as a processor. We respond within one calendar month, or faster when local regulations require.

7. Children’s data

AutoKYC is not designed for individuals under 16. Where customers onboard youth products, they must confirm lawful bases and parental consent. AutoKYC enforces consent checkpoints and age-specific workflows.

8. Changes to this policy

We review the policy at least once per year. Material updates trigger a changelog entry, email notifications to administrators, and updated DPAs. Continued use of the services constitutes acceptance of the revised policy.

If you have questions about this policy or need to exercise your rights, email privacy@autokyc.com or open a request in the Legal Center. Our team acknowledges every request within two business days.